--- title: "API Server configuration" slug: "digipassone-api-server-configuration" updated: 2026-10-27T20:13:33Z published: 2026-10-27T20:13:33Z canonical: "docs.onespan.com/digipassone-api-server-configuration" --- > ## Documentation Index > Fetch the complete documentation index at: https://docs.onespan.com/llms.txt > Use this file to discover all available pages before exploring further. # API Server configuration # Introduction When you create a tenant, you must also configure it. The majority of that configuration involves the DigipassONE API Server and its plugins. Configuration information for these components is contained in a JSON that is stored in the Auth Server's database. Use either the Admin Console or the Command Line Interface's nnl-mgmt.sh apiserver command to add or modify these configuration objects. The API Server has its own configuration object called Main. Most of the API Server plugins also have their own dedicated configuration objects. The two utility apps supplied by DigipassONE authentication software share a configuration object. In addition, DigipassONE Authenticate supplies a Default JWT Config object. This page describes the configuration objects for the following plugins and components: - [Main](/dpoa/docs/s3suite94-main-1) for the API Server - [Default JWT Config](/dpoa/docs/s3suite94-the-default-jwt-config-1) - [Utility App Configuration](/dpoa/docs/s3suite94-utility-app-configuration-1) - [JWT Processor](/dpoa/docs/s3suite94-nok-nok-authentication-api-1#jwt-processor) - [User Agent Parser](/dpoa/docs/s3suite94-nok-nok-authentication-api-1#user-agent-parser-plugin) - [EMV 3DS Generator](/dpoa/docs/s3suite94-nok-nok-authentication-api-1#emv-3ds-generator-plugin) - [IP Address Extractor](/dpoa/docs/s3suite94-nok-nok-authentication-api-1#ip-address-extractor-plugin) - [Privacy Credential Generator](/dpoa/docs/s3suite94-nok-nok-authentication-api-1#credential-simulator-plugin) - [Policy Selector](/dpoa/docs/s3suite94-nok-nok-authentication-api-1#policy-selector-plugin) - [JWT Transaction Processor](/dpoa/docs/s3suite94-nok-nok-authentication-api-1#transaction-plugin) - [External Authentication Method](/dpoa/docs/s3suite94-nok-nok-authentication-api-1#external-authentication-plugins) - [External Identity Provider](/dpoa/docs/s3suite94-federated-identity-management-1#external-identity-provider-configuration) In addition, each *type* of configuration object has its own Main object that tells which plugins of that type are enabled, what are the names of any custom plugins of that type, and other information relevant to that type of configuration object. The table below tells, for each API Server plugin or component, the type and name of its configuration object together with the circumstances when it is used. One configuration object configures the features for one tenant, so the table below describes the configuration objects for one tenant. Note that there are also plugins without configuration objects and they are not included in the table. | **Feature** | Config Object Type | **Config Object Name** | **When it is used** | | --- | --- | --- | --- | | [API Server's Main Configuration](/dpoa/docs/s3suite94-main-1) | Main | Main | Always | | [Default JWT Config](/dpoa/docs/s3suite94-the-default-jwt-config-1) | Main | jwt_config | Used by any plugin that uses jwt_config and doesn't have a local config object. | | [Utility App Configuration](/dpoa/docs/s3suite94-utility-app-configuration-1) | Main | nnlapp_config | Used to configure the two utility apps, nnlfedapp and nnlsignin. | | [Session Plugins' Main Configuration](/dpoa/docs/s3suite94-nok-nok-authentication-api-1#main) | SessionPlugin | Main | Always. Used to activate and deactivate one or more Session plugins. Also contains configuration properties applicable to all session plugins | | [JWT Processor](/dpoa/docs/s3suite94-nok-nok-authentication-api-1#jwt-processor)38 | SessionPlugin | jwt_config | Always | | [User Agent Parser](/dpoa/docs/s3suite94-nok-nok-authentication-api-1#user-agent-parser-plugin) | SessionPlugin | ua_parser | You implemented web apps that use WebAuthn. Used to identify the client platform or browser. | | [EMV 3DS Generator](/dpoa/docs/s3suite94-nok-nok-authentication-api-1#emv-3ds-generator-plugin) | SessionPlugin | jws_config | You want EMV 3DS data returned after successful FIDO registration, authentication, and transaction confirmation. You created one or more Adaptive Rules that return an EMV 3DS FIDO blob. | | [IP Address Extractor](/dpoa/docs/s3suite94-nok-nok-authentication-api-1#ip-address-extractor-plugin) | SessionPlugin | ip_address_plugin | You created one or more Adaptive Rules that use client IP address in their condition. | | [Privacy Credential Generator](/dpoa/docs/s3suite94-nok-nok-authentication-api-1#credential-simulator-plugin) | SessionPlugin | credsim_config | You implemented a native or web app that uses FIDO2, and your app needs to pass a username for an authentication operation. Use this plugin only if you don't want the server to reveal information on whether the unauthenticated user has FIDO credentials or not. | | [Policy Selector's Main Configuration](/dpoa/docs/s3suite94-nok-nok-authentication-api-1#main1) | PolicyPlugin | Main | Activate and deactivate the Policy plugin. | | [Policy Selector](/dpoa/docs/s3suite94-reference-api-server-configuration-1) | PolicyPlugin | default_config | Your app performs FIDO or OOB registration and doesn't pass the optionsData.policyName parameter. Use this plugin to resolve the policy name using default_config instead. | | [Transaction Plugin's Main Configuration](/dpoa/docs/s3suite94-nok-nok-authentication-api-1#main2) | TransactionPlugin | Main | Used to activate and deactivate the Transaction plugin. | | [JWT Transaction Processor](/dpoa/docs/s3suite94-nok-nok-authentication-api-1#jwtconfig) | TransactionPlugin | jwt_config | Your App supports transaction confirmation. | | [External Authentication Plugin's Main Configuration](/dpoa/docs/s3suite94-nok-nok-authentication-api-1#external-authentication-plugins) | ExternalAuthenticationPlugin | Main | Activate and deactivate a JWT or a Password External Authentication plugin. | | [JWT External Authentication](/dpoa/docs/s3suite94-nok-nok-authentication-api-1#jwt-external-authentication-plugin) | ExternalAuthenticationPlugin | jwt_config | You want users to authenticate with passwords or any other authentication method not supported by DigipassONE Authenticate. | | [Password External Authentication](/dpoa/docs/s3suite94-nok-nok-authentication-api-1#password-external-authentication-plugin) | ExternalAuthenticationPlugin | pwd_plugin_config | You want your users to authenticate with passwords. | | [Main Configuration for External IdPs](/dpoa/docs/s3suite94-main-1) | ExternalIdentityProvider | Main | Activate or deactivate one or more OIDC-enabled external identity providers. | | [External IdP configuration for OIDC](/dpoa/docs/s3suite94-federated-identity-management-1#external-identity-provider-configuration) | ExternalIdentityProvider | | Your External IdP is an OIDC server that authenticates the user and obtains the required session for FIDO registration. | Formerly known as Digipass S3. Formerly Digipass S3 software. Formerly known as Digipass S3 Authentication Software. Enables passkeys, multi-factor authentication (MFA), hardware authenticators, one-time password (OTP). Include the configuration object type when using the Command Line Interface's nnl-mgmt.sh apiserver command.